CVE-2026-114147: Denial of Service via Memory Leak in ASP.NET Core SignalR Redis Backplane

Vulnerability ID: CVE-2026-114147
CVSS Score: 7.5
Published: 2026-11-11

CVE-2026-114147 is a high-severity Denial of Service (DoS) vulnerability affecting ASP.NET Core and specifically the Microsoft.AspNetCore.SignalR.StackExchangeRedis scale-out provider across .NET 8.0, 9.0, 10.0, and 11.0 preview releases. The vulnerability originates from a string comparison mismatch between internal per-connection group collections and the centralized Redis channel subscription registry, compounded by a race condition during connection teardown. Remote unauthenticated attackers can exploit this flaw to leave orphaned connection contexts and active Redis pub/sub listeners pinned in memory, leading to unbounded memory exhaustion and application process termination.

TL;DR

A case-sensitivity mismatch between per-connection group tracking (case-insensitive) and centralized Redis channel registries (case-sensitive), combined with a connection teardown race condition in Microsoft.AspNetCore.SignalR.StackExchangeRedis, allows unauthenticated remote attackers to cause unbounded memory leaks and Denial of Service.

Technical Details

  • CVE ID: CVE-2026-114147
  • CWE Classification: CWE-401 (Missing Release of Memory after Effective Lifetime)
  • CVSS v3.1 Score: 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
  • Affected Component: Microsoft.AspNetCore.SignalR.StackExchangeRedis
  • Attack Vector: Network (WebSocket / SSE / Long Polling)
  • Primary Impact: Denial of Service via Unbounded Memory Leak
  • Exploit Status: Unproven (No public PoCs or active exploitation)
  • CISA KEV Status: Not Listed

Affected Systems

  • Microsoft.AspNetCore.SignalR.StackExchangeRedis
  • Microsoft .NET 8.0
  • Microsoft .NET 9.0
  • Microsoft .NET 10.0
  • Microsoft .NET 11.0
  • Microsoft Visual Studio 2022 version 17.14
  • Microsoft Visual Studio 2026 version 18.11
  • Microsoft Visual Studio 2026 version 18.12
  • Microsoft.AspNetCore.SignalR.StackExchangeRedis: < 10.0.15 (Fixed in: 10.0.15)
  • .NET 8.0: >= 8.0.0, < 8.0.34 (Fixed in: 8.0.34)
  • .NET 9.0: >= 9.0.0, < 9.0.23 (Fixed in: 9.0.23)
  • .NET 10.0: >= 10.0.0, < 10.0.15 (Fixed in: 10.0.15)
  • .NET 11.0: >= 11.0.0-preview.1, < 11.0.0 (Fixed in: 11.0.0)
  • Microsoft Visual Studio 2022 version 17.14: >= 17.14.0, < 17.14.45 (Fixed in: 17.14.45)
  • Microsoft Visual Studio 2026 version 18.11: >= 18.11.0, < 18.11.4 (Fixed in: 18.11.4)
  • Microsoft Visual Studio 2026 version 18.12: 18.12.0 (Fixed in: 18.12.0)

Code Analysis

Commit: cc53379

Merged PR 65072: [SignalR] Fix Redis scaleout group case handling. Casing was different across group collections resulting in inconsistent cleanup of connection state.

--- a/src/SignalR/server/Core/src/HubConnectionHandler.cs +++ b/src/SignalR/server/Core/src/HubConnectionHandler.cs @@ -151,6 +151,9 @@ public override async Task OnConnectedAsync(ConnectionContext connection) } finally { + // Ensure the connection is aborted before lifetime manager teardown. + await connectionContext.AbortAsync(); + connectionContext.Cleanup(); Log.ConnectedEnding(_logger); --- a/src/SignalR/server/StackExchangeRedis/src/RedisHubLifetimeManager.cs +++ b/src/SignalR/server/StackExchangeRedis/src/RedisHubLifetimeManager.cs - public HashSet<string> Groups { get; } = new HashSet<string>(StringComparer.OrdinalIgnoreCase); + public HashSet<string> Groups { get; } = new HashSet<string>(StringComparer.Ordinal); + public bool IsDisconnected { get; set; }

Commit: d94f9c2

Backport fix commit (PR 64560) for SignalR Redis scaleout group case handling and connection teardown synchronization.

Mitigation Strategies

  • Upgrade the .NET Runtime, ASP.NET Core Shared Framework, and Microsoft.AspNetCore.SignalR.StackExchangeRedis package to the November 2026 security servicing releases.
  • Normalize and canonicalize all group name strings (e.g., using ToUpperInvariant() or ToLowerInvariant()) in Hub methods before calling Groups.AddToGroupAsync and Groups.RemoveFromGroupAsync.
  • Restrict unauthenticated access to SignalR Hubs by applying the [Authorize] attribute where appropriate.
  • Implement connection and invocation rate-limiting policies on SignalR negotiation and transport endpoints (/negotiate) via reverse proxies or ASP.NET Core middleware.

Remediation Steps:

  1. Identify all ASP.NET Core projects referencing Microsoft.AspNetCore.SignalR.StackExchangeRedis.
  2. Update the Microsoft.AspNetCore.SignalR.StackExchangeRedis NuGet package reference to 8.0.34, 9.0.23, 10.0.15, or 11.0.0 depending on the target framework.
  3. Install the patched ASP.NET Core Hosting Bundle / .NET Runtime (8.0.34, 9.0.23, 10.0.15, or 11.0.0) on all hosting servers or update container base images.
  4. Rebuild, redeploy, and restart all SignalR application instances and verify memory stability and Redis active channel counts (PUBSUB NUMPAT / PUBSUB CHANNELS).

References

Read the full report for CVE-2026-114147 on our website for more details including interactive diagrams and full exploit analysis.